@webpieces/nx-webpieces-rules 0.4.844 → 0.4.846

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/nx-webpieces-rules",
-  "version": "0.4.844",
+  "version": "0.4.846",
   "description": "Nx-specific webpieces validation rules, graph tooling, executors, and inference plugin.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -19,13 +19,13 @@
     "README.md"
   ],
   "dependencies": {
-    "@webpieces/api-doc-model": "0.4.844",
-    "@webpieces/code-rules": "0.4.844",
-    "@webpieces/core-util": "0.4.844",
-    "@webpieces/eslint-rules": "0.4.844",
-    "@webpieces/rules-config": "0.4.844",
+    "@webpieces/api-doc-model": "0.4.846",
+    "@webpieces/code-rules": "0.4.846",
+    "@webpieces/core-util": "0.4.846",
+    "@webpieces/eslint-rules": "0.4.846",
+    "@webpieces/rules-config": "0.4.846",
     "madge": "8.0.0",
-    "@webpieces/rules-sdk": "0.4.844"
+    "@webpieces/rules-sdk": "0.4.846"
   },
   "peerDependencies": {
     "@nx/devkit": ">=18.0.0"
@@ -41,7 +41,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@webpieces/tooling-testkit": "0.4.844"
+    "@webpieces/tooling-testkit": "0.4.846"
   },
   "types": "./src/index.d.ts",
   "bin": {

package/src/configs/api-doc-rules-config.d.ts

@@ -0,0 +1,59 @@
+import { SchemaShape, BaseRuleConfig } from "@webpieces/rules-sdk";
+/**
+ * The modes the two CONTRACT rules accept (#1017).
+ *
+ * `AFFECTED_PROJECT` is the one a consumer normally picks, and it is the granularity nx already
+ * gives: scan the `@ApiPath` contracts of the projects the diff actually touches, instead of every
+ * contract in the workspace every time any project is affected. A contract in a project no changed
+ * file belongs to cannot have changed, so scanning it is work with no verdict in it — and on a repo
+ * measured at 98 endpoints that is the difference between a rule somebody leaves on and one they
+ * turn off.
+ *
+ * `RUN_EVERY_TIME` stays, for the full-repo migration sweep: when a team decides to publish an API
+ * they want the whole list at once, not the part of it they happened to edit this week.
+ *
+ * This is deliberately NOT diff-HUNK scoping. #1016 established that a contract's publishability is
+ * not a property of the lines you touched — adding one field to a DTO can break a document through a
+ * type three files away — so the unit stays the PROJECT, which is the unit nx itself works in.
+ */
+export declare const API_DOC_MODES: readonly ["OFF", "AFFECTED_PROJECT", "RUN_EVERY_TIME"];
+export type ApiDocMode = typeof API_DOC_MODES[number];
+/**
+ * `api-rules-for-openapi` — everything that must hold for an `@ApiPath` contract to PRODUCE an
+ * OpenAPI document, checked on every contract in the workspace whether or not it declares `@ApiType`.
+ *
+ * The rule does not restate "what is expressible". It DRIVES `@webpieces/api-doc-model`'s own
+ * extractor, so there is exactly one definition of it and the acceptance contract holds by
+ * construction: a contract that passes is one where adding `@ApiType(...)` then generates. A second
+ * implementation would drift from the generator's on the first release that improved either.
+ *
+ * `allowedPaths` exempts whole project trees, with the same glob semantics every other rule's
+ * `allowedPaths` uses. The per-site escape hatch is
+ * `// webpieces-disable api-rules-for-openapi -- <reason>`, and the REASON is mandatory.
+ *
+ * An EXISTING `no-any-unknown` disable deliberately does not silence this rule. That rule asks
+ * "is this type-safe?"; this one asks "is this field PUBLISHED to a partner with no shape?" — a
+ * different question with different right answers, so it wants its own, separately argued line.
+ */
+export declare class ApiRulesForOpenApiConfig extends BaseRuleConfig {
+    mode?: ApiDocMode;
+    allowedPaths?: string[];
+    static readonly SCHEMA: SchemaShape<ApiRulesForOpenApiConfig>;
+}
+/**
+ * `api-rules-for-mcp` — everything `api-rules-for-openapi` checks, PLUS what `McpToolRegistry`
+ * enforces at boot, moved to CI.
+ *
+ * Two rules and not one because the blast radii differ. An OpenAPI defect is DOCUMENT-WIDE: one
+ * unshaped field blocks client generation for every operation of that API. An MCP defect blocks one
+ * tool. A team publishing a partner API and no tools must be able to run the first without the
+ * second, and a config key per rule is the only way to say that.
+ *
+ * The MCP half drives `McpSchemaRenderer` itself, tool by tool, so "this passes" and "this renders"
+ * are the same statement rather than two that can disagree.
+ */
+export declare class ApiRulesForMcpConfig extends BaseRuleConfig {
+    mode?: ApiDocMode;
+    allowedPaths?: string[];
+    static readonly SCHEMA: SchemaShape<ApiRulesForMcpConfig>;
+}

package/src/configs/api-doc-rules-config.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiRulesForMcpConfig = exports.ApiRulesForOpenApiConfig = exports.API_DOC_MODES = void 0;
+const rules_sdk_1 = require("@webpieces/rules-sdk");
+/**
+ * The modes the two CONTRACT rules accept (#1017).
+ *
+ * `AFFECTED_PROJECT` is the one a consumer normally picks, and it is the granularity nx already
+ * gives: scan the `@ApiPath` contracts of the projects the diff actually touches, instead of every
+ * contract in the workspace every time any project is affected. A contract in a project no changed
+ * file belongs to cannot have changed, so scanning it is work with no verdict in it — and on a repo
+ * measured at 98 endpoints that is the difference between a rule somebody leaves on and one they
+ * turn off.
+ *
+ * `RUN_EVERY_TIME` stays, for the full-repo migration sweep: when a team decides to publish an API
+ * they want the whole list at once, not the part of it they happened to edit this week.
+ *
+ * This is deliberately NOT diff-HUNK scoping. #1016 established that a contract's publishability is
+ * not a property of the lines you touched — adding one field to a DTO can break a document through a
+ * type three files away — so the unit stays the PROJECT, which is the unit nx itself works in.
+ */
+exports.API_DOC_MODES = ['OFF', 'AFFECTED_PROJECT', 'RUN_EVERY_TIME'];
+/**
+ * `api-rules-for-openapi` — everything that must hold for an `@ApiPath` contract to PRODUCE an
+ * OpenAPI document, checked on every contract in the workspace whether or not it declares `@ApiType`.
+ *
+ * The rule does not restate "what is expressible". It DRIVES `@webpieces/api-doc-model`'s own
+ * extractor, so there is exactly one definition of it and the acceptance contract holds by
+ * construction: a contract that passes is one where adding `@ApiType(...)` then generates. A second
+ * implementation would drift from the generator's on the first release that improved either.
+ *
+ * `allowedPaths` exempts whole project trees, with the same glob semantics every other rule's
+ * `allowedPaths` uses. The per-site escape hatch is
+ * `// webpieces-disable api-rules-for-openapi -- <reason>`, and the REASON is mandatory.
+ *
+ * An EXISTING `no-any-unknown` disable deliberately does not silence this rule. That rule asks
+ * "is this type-safe?"; this one asks "is this field PUBLISHED to a partner with no shape?" — a
+ * different question with different right answers, so it wants its own, separately argued line.
+ */
+class ApiRulesForOpenApiConfig extends rules_sdk_1.BaseRuleConfig {
+    allowedPaths;
+    static SCHEMA = {
+        mode: new rules_sdk_1.FieldDef('string', exports.API_DOC_MODES),
+        allowedPaths: rules_sdk_1.FieldDef.optional('string[]'),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.ApiRulesForOpenApiConfig = ApiRulesForOpenApiConfig;
+/**
+ * `api-rules-for-mcp` — everything `api-rules-for-openapi` checks, PLUS what `McpToolRegistry`
+ * enforces at boot, moved to CI.
+ *
+ * Two rules and not one because the blast radii differ. An OpenAPI defect is DOCUMENT-WIDE: one
+ * unshaped field blocks client generation for every operation of that API. An MCP defect blocks one
+ * tool. A team publishing a partner API and no tools must be able to run the first without the
+ * second, and a config key per rule is the only way to say that.
+ *
+ * The MCP half drives `McpSchemaRenderer` itself, tool by tool, so "this passes" and "this renders"
+ * are the same statement rather than two that can disagree.
+ */
+class ApiRulesForMcpConfig extends rules_sdk_1.BaseRuleConfig {
+    allowedPaths;
+    static SCHEMA = {
+        mode: new rules_sdk_1.FieldDef('string', exports.API_DOC_MODES),
+        allowedPaths: rules_sdk_1.FieldDef.optional('string[]'),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.ApiRulesForMcpConfig = ApiRulesForMcpConfig;
+//# sourceMappingURL=api-doc-rules-config.js.map

package/src/configs/api-doc-rules-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-doc-rules-config.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/configs/api-doc-rules-config.ts"],"names":[],"mappings":";;;AAAA,oDAA+F;AAC/F;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,aAAa,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,CAAU,CAAC;AAIpF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,wBAAyB,SAAQ,0BAAc;IAExD,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,4BAAgB;KACtB,CAAC;;AARN,4DASC;AAED;;;;;;;;;;;GAWG;AACH,MAAa,oBAAqB,SAAQ,0BAAc;IAEpD,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAsC;QACxD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,4BAAgB;KACtB,CAAC;;AARN,oDASC","sourcesContent":["import { FieldDef, SchemaShape, BaseRuleConfig, BASE_RULE_SCHEMA } from \"@webpieces/rules-sdk\";\n/**\n * The modes the two CONTRACT rules accept (#1017).\n *\n * `AFFECTED_PROJECT` is the one a consumer normally picks, and it is the granularity nx already\n * gives: scan the `@ApiPath` contracts of the projects the diff actually touches, instead of every\n * contract in the workspace every time any project is affected. A contract in a project no changed\n * file belongs to cannot have changed, so scanning it is work with no verdict in it — and on a repo\n * measured at 98 endpoints that is the difference between a rule somebody leaves on and one they\n * turn off.\n *\n * `RUN_EVERY_TIME` stays, for the full-repo migration sweep: when a team decides to publish an API\n * they want the whole list at once, not the part of it they happened to edit this week.\n *\n * This is deliberately NOT diff-HUNK scoping. #1016 established that a contract's publishability is\n * not a property of the lines you touched — adding one field to a DTO can break a document through a\n * type three files away — so the unit stays the PROJECT, which is the unit nx itself works in.\n */\nexport const API_DOC_MODES = ['OFF', 'AFFECTED_PROJECT', 'RUN_EVERY_TIME'] as const;\n\nexport type ApiDocMode = typeof API_DOC_MODES[number];\n\n/**\n * `api-rules-for-openapi` — everything that must hold for an `@ApiPath` contract to PRODUCE an\n * OpenAPI document, checked on every contract in the workspace whether or not it declares `@ApiType`.\n *\n * The rule does not restate \"what is expressible\". It DRIVES `@webpieces/api-doc-model`'s own\n * extractor, so there is exactly one definition of it and the acceptance contract holds by\n * construction: a contract that passes is one where adding `@ApiType(...)` then generates. A second\n * implementation would drift from the generator's on the first release that improved either.\n *\n * `allowedPaths` exempts whole project trees, with the same glob semantics every other rule's\n * `allowedPaths` uses. The per-site escape hatch is\n * `// webpieces-disable api-rules-for-openapi -- <reason>`, and the REASON is mandatory.\n *\n * An EXISTING `no-any-unknown` disable deliberately does not silence this rule. That rule asks\n * \"is this type-safe?\"; this one asks \"is this field PUBLISHED to a partner with no shape?\" — a\n * different question with different right answers, so it wants its own, separately argued line.\n */\nexport class ApiRulesForOpenApiConfig extends BaseRuleConfig {\n    declare mode?: ApiDocMode;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<ApiRulesForOpenApiConfig> = {\n        mode: new FieldDef('string', API_DOC_MODES),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n/**\n * `api-rules-for-mcp` — everything `api-rules-for-openapi` checks, PLUS what `McpToolRegistry`\n * enforces at boot, moved to CI.\n *\n * Two rules and not one because the blast radii differ. An OpenAPI defect is DOCUMENT-WIDE: one\n * unshaped field blocks client generation for every operation of that API. An MCP defect blocks one\n * tool. A team publishing a partner API and no tools must be able to run the first without the\n * second, and a config key per rule is the only way to say that.\n *\n * The MCP half drives `McpSchemaRenderer` itself, tool by tool, so \"this passes\" and \"this renders\"\n * are the same statement rather than two that can disagree.\n */\nexport class ApiRulesForMcpConfig extends BaseRuleConfig {\n    declare mode?: ApiDocMode;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<ApiRulesForMcpConfig> = {\n        mode: new FieldDef('string', API_DOC_MODES),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}

package/src/configs/no-root-union-config.d.ts

@@ -0,0 +1,25 @@
+import { SchemaShape, BaseRuleConfig } from "@webpieces/rules-sdk";
+import { StructuralMode } from "./rule-configs";
+/**
+ * `no-root-union-api-type` — a request or response type that IS a union, on any `@ApiPath` contract.
+ *
+ * Both the OpenAI and the Anthropic function-calling APIs forbid `oneOf`/`anyOf`/`allOf` at the TOP
+ * level of a tool's parameter schema, and a server sends its WHOLE tool list on every request — so
+ * ONE offending tool makes every request 400 and the entire client session is unusable, not just
+ * that tool. Nested composition, inside a property, is fine; only the root is the problem.
+ *
+ * It is checked on EVERY `@ApiPath` contract, whether or not it declares `@ApiType`. `@ApiType` is a
+ * PUBLISHING decision added later, on purpose, so a shape rule that only ran on contracts which had
+ * already opted in would let a team discover six months afterwards that the type was never
+ * expressible — by which time it is in partners' generated clients and cannot be changed.
+ *
+ * `allowedPaths` exempts whole trees, with the same glob semantics every other rule's `allowedPaths`
+ * uses. The per-site escape hatch is `// webpieces-disable no-root-union-api-type -- <reason>`, and
+ * the REASON is mandatory: this defect's blast radius is every tool in a session, so a suppression
+ * has to carry an argument somebody wrote down.
+ */
+export declare class NoRootUnionApiTypeConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    allowedPaths?: string[];
+    static readonly SCHEMA: SchemaShape<NoRootUnionApiTypeConfig>;
+}

package/src/configs/no-root-union-config.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoRootUnionApiTypeConfig = void 0;
+const rules_sdk_1 = require("@webpieces/rules-sdk");
+const rule_configs_1 = require("./rule-configs");
+/**
+ * `no-root-union-api-type` — a request or response type that IS a union, on any `@ApiPath` contract.
+ *
+ * Both the OpenAI and the Anthropic function-calling APIs forbid `oneOf`/`anyOf`/`allOf` at the TOP
+ * level of a tool's parameter schema, and a server sends its WHOLE tool list on every request — so
+ * ONE offending tool makes every request 400 and the entire client session is unusable, not just
+ * that tool. Nested composition, inside a property, is fine; only the root is the problem.
+ *
+ * It is checked on EVERY `@ApiPath` contract, whether or not it declares `@ApiType`. `@ApiType` is a
+ * PUBLISHING decision added later, on purpose, so a shape rule that only ran on contracts which had
+ * already opted in would let a team discover six months afterwards that the type was never
+ * expressible — by which time it is in partners' generated clients and cannot be changed.
+ *
+ * `allowedPaths` exempts whole trees, with the same glob semantics every other rule's `allowedPaths`
+ * uses. The per-site escape hatch is `// webpieces-disable no-root-union-api-type -- <reason>`, and
+ * the REASON is mandatory: this defect's blast radius is every tool in a session, so a suppression
+ * has to carry an argument somebody wrote down.
+ */
+class NoRootUnionApiTypeConfig extends rules_sdk_1.BaseRuleConfig {
+    allowedPaths;
+    static SCHEMA = {
+        mode: new rules_sdk_1.FieldDef('string', rule_configs_1.STRUCTURAL_MODES),
+        allowedPaths: rules_sdk_1.FieldDef.optional('string[]'),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.NoRootUnionApiTypeConfig = NoRootUnionApiTypeConfig;
+//# sourceMappingURL=no-root-union-config.js.map

package/src/configs/no-root-union-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-root-union-config.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/configs/no-root-union-config.ts"],"names":[],"mappings":";;;AAAA,oDAA+F;AAC/F,iDAAkE;AAClE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,wBAAyB,SAAQ,0BAAc;IAExD,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,+BAAgB,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,4BAAgB;KACtB,CAAC;;AARN,4DASC","sourcesContent":["import { FieldDef, SchemaShape, BaseRuleConfig, BASE_RULE_SCHEMA } from \"@webpieces/rules-sdk\";\nimport { StructuralMode, STRUCTURAL_MODES } from \"./rule-configs\";\n/**\n * `no-root-union-api-type` — a request or response type that IS a union, on any `@ApiPath` contract.\n *\n * Both the OpenAI and the Anthropic function-calling APIs forbid `oneOf`/`anyOf`/`allOf` at the TOP\n * level of a tool's parameter schema, and a server sends its WHOLE tool list on every request — so\n * ONE offending tool makes every request 400 and the entire client session is unusable, not just\n * that tool. Nested composition, inside a property, is fine; only the root is the problem.\n *\n * It is checked on EVERY `@ApiPath` contract, whether or not it declares `@ApiType`. `@ApiType` is a\n * PUBLISHING decision added later, on purpose, so a shape rule that only ran on contracts which had\n * already opted in would let a team discover six months afterwards that the type was never\n * expressible — by which time it is in partners' generated clients and cannot be changed.\n *\n * `allowedPaths` exempts whole trees, with the same glob semantics every other rule's `allowedPaths`\n * uses. The per-site escape hatch is `// webpieces-disable no-root-union-api-type -- <reason>`, and\n * the REASON is mandatory: this defect's blast radius is every tool in a session, so a suppression\n * has to carry an argument somebody wrote down.\n */\nexport class NoRootUnionApiTypeConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoRootUnionApiTypeConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}

package/src/configs/rule-configs.d.ts

@@ -0,0 +1,67 @@
+import { BaseRuleConfig } from "@webpieces/rules-sdk";
+import { SchemaShape } from "@webpieces/rules-sdk";
+export declare const STRUCTURAL_MODES: readonly ["OFF", "RUN_EVERY_TIME"];
+export type StructuralMode = typeof STRUCTURAL_MODES[number];
+export declare class NoFileImportCyclesConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    ignoreTypeOnly?: boolean;
+    excludePackages?: string[];
+    excludeRegExp?: string[];
+    static readonly SCHEMA: SchemaShape<NoFileImportCyclesConfig>;
+}
+export declare class RuntimeArchitectureConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    /**
+     * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo
+     * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one
+     * hop short of. Defaults to true; set false in a repo whose external surface is noisy. Purely a
+     * RENDER switch: levels, cycle detection and runtime-dependencies.json are identical either way.
+     */
+    showExternalNodes?: boolean;
+    /**
+     * Project roots whose exported `*Api` types are contracts for systems OUTSIDE this repo
+     * (firestore, gmail, gcp-storage, ...), e.g. `["libraries/apis/external/**"]`. Globs, matched
+     * against the nx project root.
+     *
+     * Needed because an external contract does NOT look like an in-repo one: it is a plain
+     * `interface` bound to a Symbol token and injected, never an `abstract class` carrying @ApiPath
+     * reached through `createRpcClient`. Without this list the scanner has no way to tell a vendor
+     * seam from any other library, so every call leaving the repo is invisible to the runtime graph.
+     *
+     * Defaults to none, which is correct for a repo with no vendor wrapper libraries.
+     */
+    externalApiPaths?: string[];
+    static readonly SCHEMA: SchemaShape<RuntimeArchitectureConfig>;
+}
+export declare class NxWiringConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    static readonly SCHEMA: SchemaShape<NxWiringConfig>;
+}
+export declare class DiGraphConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    static readonly SCHEMA: SchemaShape<DiGraphConfig>;
+}
+export declare class MissingDesignAnnotationConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    static readonly SCHEMA: SchemaShape<MissingDesignAnnotationConfig>;
+}
+export declare class ValidateArchitectureUnchangedConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    static readonly SCHEMA: SchemaShape<ValidateArchitectureUnchangedConfig>;
+}
+export declare class ValidateNoArchitectureCyclesConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    static readonly SCHEMA: SchemaShape<ValidateNoArchitectureCyclesConfig>;
+}
+export declare class ValidatePackageJsonConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    static readonly SCHEMA: SchemaShape<ValidatePackageJsonConfig>;
+}
+export declare class ValidateVersionsLockedConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    static readonly SCHEMA: SchemaShape<ValidateVersionsLockedConfig>;
+}
+export declare class ValidateEslintSyncConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    static readonly SCHEMA: SchemaShape<ValidateEslintSyncConfig>;
+}

package/src/configs/rule-configs.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ValidateEslintSyncConfig = exports.ValidateVersionsLockedConfig = exports.ValidatePackageJsonConfig = exports.ValidateNoArchitectureCyclesConfig = exports.ValidateArchitectureUnchangedConfig = exports.MissingDesignAnnotationConfig = exports.DiGraphConfig = exports.NxWiringConfig = exports.RuntimeArchitectureConfig = exports.NoFileImportCyclesConfig = exports.STRUCTURAL_MODES = void 0;
+const rules_sdk_1 = require("@webpieces/rules-sdk");
+const rules_sdk_2 = require("@webpieces/rules-sdk");
+// Structural / whole-graph rules (import-cycle, runtime-architecture, nx-wiring). They can't be
+// scoped to changed lines/files — a cycle or wiring break can route through a project that wasn't
+// itself edited — so when active they run the FULL check every time (nx-affected already limits
+// them to affected projects externally). RUN_EVERY_TIME replaces the old, vaguer "ON".
+exports.STRUCTURAL_MODES = ['OFF', 'RUN_EVERY_TIME'];
+// NOTE: there is deliberately no `WholeRepoBuildGuardConfig`. That guard has NO webpieces.config.json
+// entry — it is EXPERIMENTAL and OFF by default, and its only switch is the OPT-IN
+// `experimental.whole-repo-build-guard: true` in the optional machine-local ~/.webpieces/config.json
+// (see home-config.ts). The build command it prints
+// is handed to it directly from `commands.pr-gate.buildCommand` by ai-hook-rules' runner. Re-adding a
+// config class here puts the guard back in RULE_SCHEMAS and makes it a fault-Y rule again.
+class NoFileImportCyclesConfig extends rules_sdk_1.BaseRuleConfig {
+    ignoreTypeOnly;
+    excludePackages;
+    // Raw regex escape hatch for a cycle inside the project being checked — generated code, a
+    // vendored tree, or a deliberate bidirectional domain model — that `excludePackages` cannot reach
+    // (it resolves npm package NAMES, so it only excludes a *sibling* package, never a directory
+    // inside this one). Patterns are handed to madge verbatim and matched against ids RELATIVE TO THE
+    // PROJECT (e.g. "^src/generated/", "^src/modules/(item|category)/") — NOT workspace-rooted or
+    // absolute, which silently match nothing. The executor warns when a pattern matches zero
+    // traversed files, so a mis-anchored pattern is visible rather than a silent no-op.
+    excludeRegExp;
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ignoreTypeOnly: rules_sdk_2.FieldDef.optional('boolean'),
+        excludePackages: rules_sdk_2.FieldDef.optional('string[]'),
+        excludeRegExp: rules_sdk_2.FieldDef.optional('string[]'),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.NoFileImportCyclesConfig = NoFileImportCyclesConfig;
+class RuntimeArchitectureConfig extends rules_sdk_1.BaseRuleConfig {
+    // NOTE: `servicePaths` / `apiProjectPaths` were removed — they were never read. The runtime graph
+    // is derived SOLELY from architecture/dependencies.json apiRelations + project roles (see
+    // nx-webpieces-rules/src/lib/runtime-graph.ts), so any config still listing them (a hand-maintained
+    // enumeration of api libs) now fails the unknown-field check in validateWebpiecesConfig. There is
+    // nothing to enumerate — delete the keys.
+    // NOTE: `allowedCycles` was removed — a runtime cycle is no longer allowable at all. CD deploys
+    // services in dependency order and a cyclic architecture has no such order, so the runtime graph
+    // now THROWS while it is being levelled rather than emitting a flat, unlevellable diagram (see
+    // nx-webpieces-rules/src/lib/runtime-graph-levels.ts). A repo that genuinely cannot break a cycle
+    // yet declares it PER EDGE with a `cutLegacyCycle:<targetService>` nx tag on the CALLING project,
+    // which admits the debt in a place `grep -rn cutLegacyCycle` can enumerate. Delete the key.
+    /**
+     * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo
+     * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one
+     * hop short of. Defaults to true; set false in a repo whose external surface is noisy. Purely a
+     * RENDER switch: levels, cycle detection and runtime-dependencies.json are identical either way.
+     */
+    showExternalNodes;
+    /**
+     * Project roots whose exported `*Api` types are contracts for systems OUTSIDE this repo
+     * (firestore, gmail, gcp-storage, ...), e.g. `["libraries/apis/external/**"]`. Globs, matched
+     * against the nx project root.
+     *
+     * Needed because an external contract does NOT look like an in-repo one: it is a plain
+     * `interface` bound to a Symbol token and injected, never an `abstract class` carrying @ApiPath
+     * reached through `createRpcClient`. Without this list the scanner has no way to tell a vendor
+     * seam from any other library, so every call leaving the repo is invisible to the runtime graph.
+     *
+     * Defaults to none, which is correct for a repo with no vendor wrapper libraries.
+     */
+    externalApiPaths;
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        showExternalNodes: rules_sdk_2.FieldDef.optional('boolean'),
+        externalApiPaths: rules_sdk_2.FieldDef.optional('string[]'),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.RuntimeArchitectureConfig = RuntimeArchitectureConfig;
+class NxWiringConfig extends rules_sdk_1.BaseRuleConfig {
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.NxWiringConfig = NxWiringConfig;
+class DiGraphConfig extends rules_sdk_1.BaseRuleConfig {
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.DiGraphConfig = DiGraphConfig;
+class MissingDesignAnnotationConfig extends rules_sdk_1.BaseRuleConfig {
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.MissingDesignAnnotationConfig = MissingDesignAnnotationConfig;
+// ---------------------------------------------------------------------------
+// The five Nx infrastructure validators (architecture-unchanged, no-architecture-cycles,
+// packagejson, versions-locked, eslint-sync). Each is whole-graph / whole-repo by nature (a cycle, a
+// drifted dependencies.json, an unlocked version can be introduced by a file nobody in this diff
+// touched), so the only honest mode set is STRUCTURAL_MODES: RUN_EVERY_TIME (the default) or OFF.
+//
+// All five now honor the universal escape hatches (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch)
+// via shouldSkipRule — the RuleGate is called with honorEpoch:true from
+// every executor. This lets a repo time-box or branch-scope a failing infrastructure check (e.g. hold
+// validate-packagejson off until an upgrade PR lands) with a one-value edit, instead of only the
+// blunt "mode": "OFF". Originally packagejson/versions-locked/eslint-sync were all-or-nothing on the
+// theory that "no blessed baseline" made grandfathering meaningless, but a time-box is a schedule, not
+// a baseline: "do not enforce this until <epoch>/off <branch>" is coherent for any rule.
+// ---------------------------------------------------------------------------
+class ValidateArchitectureUnchangedConfig extends rules_sdk_1.BaseRuleConfig {
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.ValidateArchitectureUnchangedConfig = ValidateArchitectureUnchangedConfig;
+class ValidateNoArchitectureCyclesConfig extends rules_sdk_1.BaseRuleConfig {
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.ValidateNoArchitectureCyclesConfig = ValidateNoArchitectureCyclesConfig;
+class ValidatePackageJsonConfig extends rules_sdk_1.BaseRuleConfig {
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.ValidatePackageJsonConfig = ValidatePackageJsonConfig;
+class ValidateVersionsLockedConfig extends rules_sdk_1.BaseRuleConfig {
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.ValidateVersionsLockedConfig = ValidateVersionsLockedConfig;
+class ValidateEslintSyncConfig extends rules_sdk_1.BaseRuleConfig {
+    static SCHEMA = {
+        mode: new rules_sdk_2.FieldDef('string', exports.STRUCTURAL_MODES),
+        ...rules_sdk_1.BASE_RULE_SCHEMA,
+    };
+}
+exports.ValidateEslintSyncConfig = ValidateEslintSyncConfig;
+//# sourceMappingURL=rule-configs.js.map

package/src/configs/rule-configs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-configs.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/configs/rule-configs.ts"],"names":[],"mappings":";;;AAAA,oDAAwE;AACxE,oDAA6D;AAC7D,gGAAgG;AAChG,kGAAkG;AAClG,gGAAgG;AAChG,uFAAuF;AAC1E,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAU,CAAC;AAInE,sGAAsG;AACtG,mFAAmF;AACnF,qGAAqG;AACrG,oDAAoD;AACpD,sGAAsG;AACtG,2FAA2F;AAE3F,MAAa,wBAAyB,SAAQ,0BAAc;IAExD,cAAc,CAAW;IACzB,eAAe,CAAY;IAC3B,0FAA0F;IAC1F,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,8FAA8F;IAC9F,yFAAyF;IACzF,oFAAoF;IACpF,aAAa,CAAY;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,GAAG,4BAAgB;KACtB,CAAC;;AAnBN,4DAoBC;AAED,MAAa,yBAA0B,SAAQ,0BAAc;IAEzD,kGAAkG;IAClG,0FAA0F;IAC1F,oGAAoG;IACpG,kGAAkG;IAClG,0CAA0C;IAC1C,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,4FAA4F;IAC5F;;;;;OAKG;IACH,iBAAiB,CAAW;IAC5B;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAY;IAE5B,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,iBAAiB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,GAAG,4BAAgB;KACtB,CAAC;;AAvCN,8DAwCC;AAED,MAAa,cAAe,SAAQ,0BAAc;IAG9C,MAAM,CAAU,MAAM,GAAgC;QAClD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,4BAAgB;KACtB,CAAC;;AANN,wCAOC;AAED,MAAa,aAAc,SAAQ,0BAAc;IAK7C,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,4BAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,6BAA8B,SAAQ,0BAAc;IAK7D,MAAM,CAAU,MAAM,GAA+C;QACjE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,4BAAgB;KACtB,CAAC;;AARN,sEASC;AAED,8EAA8E;AAC9E,yFAAyF;AACzF,qGAAqG;AACrG,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,qGAAqG;AACrG,wEAAwE;AACxE,sGAAsG;AACtG,iGAAiG;AACjG,qGAAqG;AACrG,uGAAuG;AACvG,yFAAyF;AACzF,8EAA8E;AAE9E,MAAa,mCAAoC,SAAQ,0BAAc;IAGnE,MAAM,CAAU,MAAM,GAAqD;QACvE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,4BAAgB;KACtB,CAAC;;AANN,kFAOC;AAED,MAAa,kCAAmC,SAAQ,0BAAc;IAGlE,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,4BAAgB;KACtB,CAAC;;AANN,gFAOC;AAED,MAAa,yBAA0B,SAAQ,0BAAc;IAGzD,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,4BAAgB;KACtB,CAAC;;AANN,8DAOC;AAED,MAAa,4BAA6B,SAAQ,0BAAc;IAG5D,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,4BAAgB;KACtB,CAAC;;AANN,oEAOC;AAED,MAAa,wBAAyB,SAAQ,0BAAc;IAGxD,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,4BAAgB;KACtB,CAAC;;AANN,4DAOC","sourcesContent":["import { BaseRuleConfig, BASE_RULE_SCHEMA } from \"@webpieces/rules-sdk\";\nimport { FieldDef, SchemaShape } from \"@webpieces/rules-sdk\";\n// Structural / whole-graph rules (import-cycle, runtime-architecture, nx-wiring). They can't be\n// scoped to changed lines/files — a cycle or wiring break can route through a project that wasn't\n// itself edited — so when active they run the FULL check every time (nx-affected already limits\n// them to affected projects externally). RUN_EVERY_TIME replaces the old, vaguer \"ON\".\nexport const STRUCTURAL_MODES = ['OFF', 'RUN_EVERY_TIME'] as const;\n\nexport type StructuralMode = typeof STRUCTURAL_MODES[number];\n\n// NOTE: there is deliberately no `WholeRepoBuildGuardConfig`. That guard has NO webpieces.config.json\n// entry — it is EXPERIMENTAL and OFF by default, and its only switch is the OPT-IN\n// `experimental.whole-repo-build-guard: true` in the optional machine-local ~/.webpieces/config.json\n// (see home-config.ts). The build command it prints\n// is handed to it directly from `commands.pr-gate.buildCommand` by ai-hook-rules' runner. Re-adding a\n// config class here puts the guard back in RULE_SCHEMAS and makes it a fault-Y rule again.\n\nexport class NoFileImportCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    ignoreTypeOnly?: boolean;\n    excludePackages?: string[];\n    // Raw regex escape hatch for a cycle inside the project being checked — generated code, a\n    // vendored tree, or a deliberate bidirectional domain model — that `excludePackages` cannot reach\n    // (it resolves npm package NAMES, so it only excludes a *sibling* package, never a directory\n    // inside this one). Patterns are handed to madge verbatim and matched against ids RELATIVE TO THE\n    // PROJECT (e.g. \"^src/generated/\", \"^src/modules/(item|category)/\") — NOT workspace-rooted or\n    // absolute, which silently match nothing. The executor warns when a pattern matches zero\n    // traversed files, so a mis-anchored pattern is visible rather than a silent no-op.\n    excludeRegExp?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFileImportCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ignoreTypeOnly: FieldDef.optional('boolean'),\n        excludePackages: FieldDef.optional('string[]'),\n        excludeRegExp: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RuntimeArchitectureConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    // NOTE: `servicePaths` / `apiProjectPaths` were removed — they were never read. The runtime graph\n    // is derived SOLELY from architecture/dependencies.json apiRelations + project roles (see\n    // nx-webpieces-rules/src/lib/runtime-graph.ts), so any config still listing them (a hand-maintained\n    // enumeration of api libs) now fails the unknown-field check in validateWebpiecesConfig. There is\n    // nothing to enumerate — delete the keys.\n    // NOTE: `allowedCycles` was removed — a runtime cycle is no longer allowable at all. CD deploys\n    // services in dependency order and a cyclic architecture has no such order, so the runtime graph\n    // now THROWS while it is being levelled rather than emitting a flat, unlevellable diagram (see\n    // nx-webpieces-rules/src/lib/runtime-graph-levels.ts). A repo that genuinely cannot break a cycle\n    // yet declares it PER EDGE with a `cutLegacyCycle:<targetService>` nx tag on the CALLING project,\n    // which admits the debt in a place `grep -rn cutLegacyCycle` can enumerate. Delete the key.\n    /**\n     * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo\n     * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one\n     * hop short of. Defaults to true; set false in a repo whose external surface is noisy. Purely a\n     * RENDER switch: levels, cycle detection and runtime-dependencies.json are identical either way.\n     */\n    showExternalNodes?: boolean;\n    /**\n     * Project roots whose exported `*Api` types are contracts for systems OUTSIDE this repo\n     * (firestore, gmail, gcp-storage, ...), e.g. `[\"libraries/apis/external/**\"]`. Globs, matched\n     * against the nx project root.\n     *\n     * Needed because an external contract does NOT look like an in-repo one: it is a plain\n     * `interface` bound to a Symbol token and injected, never an `abstract class` carrying @ApiPath\n     * reached through `createRpcClient`. Without this list the scanner has no way to tell a vendor\n     * seam from any other library, so every call leaving the repo is invisible to the runtime graph.\n     *\n     * Defaults to none, which is correct for a repo with no vendor wrapper libraries.\n     */\n    externalApiPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<RuntimeArchitectureConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        showExternalNodes: FieldDef.optional('boolean'),\n        externalApiPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NxWiringConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<NxWiringConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class DiGraphConfig extends BaseRuleConfig {\n    // Structural: the DI graph is regenerated whole-project on every build (generate +\n    // unchanged gate), so it cannot be scoped to changed lines.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<DiGraphConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MissingDesignAnnotationConfig extends BaseRuleConfig {\n    // Structural: enforced per-project by the di-graph-generate executor, which\n    // roots the whole DI design on @DocumentDesign classes — cannot be line-scoped.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<MissingDesignAnnotationConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// ---------------------------------------------------------------------------\n// The five Nx infrastructure validators (architecture-unchanged, no-architecture-cycles,\n// packagejson, versions-locked, eslint-sync). Each is whole-graph / whole-repo by nature (a cycle, a\n// drifted dependencies.json, an unlocked version can be introduced by a file nobody in this diff\n// touched), so the only honest mode set is STRUCTURAL_MODES: RUN_EVERY_TIME (the default) or OFF.\n//\n// All five now honor the universal escape hatches (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch)\n// via shouldSkipRule — the RuleGate is called with honorEpoch:true from\n// every executor. This lets a repo time-box or branch-scope a failing infrastructure check (e.g. hold\n// validate-packagejson off until an upgrade PR lands) with a one-value edit, instead of only the\n// blunt \"mode\": \"OFF\". Originally packagejson/versions-locked/eslint-sync were all-or-nothing on the\n// theory that \"no blessed baseline\" made grandfathering meaningless, but a time-box is a schedule, not\n// a baseline: \"do not enforce this until <epoch>/off <branch>\" is coherent for any rule.\n// ---------------------------------------------------------------------------\n\nexport class ValidateArchitectureUnchangedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateArchitectureUnchangedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateNoArchitectureCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateNoArchitectureCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidatePackageJsonConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidatePackageJsonConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateVersionsLockedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateVersionsLockedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateEslintSyncConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateEslintSyncConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}

package/src/configs/tag-truth-configs.d.ts

@@ -0,0 +1,72 @@
+import { SchemaShape, BaseRuleConfig } from "@webpieces/rules-sdk";
+import { StructuralMode } from "./rule-configs";
+/** One `role:api-client` project and the outside packages it may import (its SDK, inversify, …). Data-only. */
+export declare class ApiClientPackagesEntry {
+    /** The nx project name of the `role:api-client` library, e.g. `gmail-client`. */
+    project: string;
+    /** Package names (globs allowed, e.g. `@google-cloud/*`) it may import beyond `apiLibPackages`. */
+    packages: string[];
+    static readonly SCHEMA: SchemaShape<ApiClientPackagesEntry>;
+}
+/**
+ * `api-lib-dependencies` (D2) — a `role:api-lib` may depend only on other `role:api-lib` projects plus
+ * the outside packages in `apiLibPackages`; a `role:api-client` may ALSO import the packages its own
+ * `apiClients` entry names (its SDK, `inversify`, `@webpieces/core-context`, …).
+ *
+ * - `mode` — OFF | RUN_EVERY_TIME (a graph rule: it reads every project, every run).
+ * - `apiLibPackages` — required; may be empty (an api library then imports nothing from outside), e.g.
+ *   `["@webpieces/core-util", "tslib"]`. A workspace project whose name or package name is listed here
+ *   is allowed too, so a repo whose `core-util` is a workspace project states it the same way.
+ * - `apiClients` — required; one entry per `role:api-client` project. A `role:api-client` with no
+ *   entry is itself a violation: what it may talk to is stated, never inferred.
+ */
+export declare class ApiLibDependenciesConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    apiLibPackages: string[];
+    apiClients: ApiClientPackagesEntry[];
+    static readonly SCHEMA: SchemaShape<ApiLibDependenciesConfig>;
+}
+/**
+ * `api-lib-path` (D10) — both directions: every `role:api-lib` / `role:api-client` project lives under
+ * one of `paths`, and every project under `paths` carries one of those two roles.
+ *
+ * - `mode` — OFF | RUN_EVERY_TIME.
+ * - `paths` — required, non-empty globs over project ROOTS, e.g. `["libraries/apis/**"]`.
+ */
+export declare class ApiLibPathConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    paths: string[];
+    static readonly SCHEMA: SchemaShape<ApiLibPathConfig>;
+}
+/**
+ * One folder of the runtime layout: the project roots it covers, the framework SETS a project there may
+ * carry, and the roles it may have. Data-only.
+ *
+ * A framework set is written as its tags joined by `+`, in any order: `"browser+node+react-native"`.
+ * Listing two sets means EITHER — `["node", "express"]` is a node library or an express one.
+ */
+export declare class FrameworkFolderEntry {
+    /** Globs over project ROOTS, e.g. `["libraries/universal/**"]`. Non-empty. */
+    paths: string[];
+    /** The accepted framework sets, each `+`-joined, e.g. `["browser+node+react-native"]`. Non-empty. */
+    frameworkSets: string[];
+    /** The accepted roles, e.g. `["lib", "designed-lib"]`. Non-empty. */
+    roles: string[];
+    static readonly SCHEMA: SchemaShape<FrameworkFolderEntry>;
+}
+/**
+ * `framework-folder` (D9) — the folder a library lives in and the tags it carries say the same thing,
+ * both directions:
+ *  - a project under an entry's `paths` (the FIRST entry whose glob matches, in `entries` order) must
+ *    carry one of that entry's `frameworkSets`, exactly, and one of its `roles`;
+ *  - a LIBRARY (any role but server/app/client/bundle) carrying a framework set and role that some entry
+ *    lists must live under one of the entries that list them.
+ *
+ * - `mode` — OFF | RUN_EVERY_TIME.
+ * - `entries` — required, non-empty. The recommended layout is in `.claude/rules/framework-tags.md`.
+ */
+export declare class FrameworkFolderConfig extends BaseRuleConfig {
+    mode?: StructuralMode;
+    entries: FrameworkFolderEntry[];
+    static readonly SCHEMA: SchemaShape<FrameworkFolderConfig>;
+}